Description
Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. Attackers can send a single deeply nested request to WebMail, WebAdmin, or WebMail Proxy listeners to exhaust the stack and crash SMTP, IMAP, POP3, and web services repeatedly.
Published: 2026-10-30
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Patch
AI Analysis

Impact

The Axigen Mail Server contains an uncontrolled recursion flaw that allows attackers to send a single, deeply nested SOAP/XML or JSON request to the WebMail, WebAdmin, or WebMail Proxy listeners before authentication. The unbounded nesting exhausts the server stack, causing the SMTP, IMAP, POP3, and web services to crash repeatedly and making the mail server unavailable for legitimate users.

Affected Systems

Axigen Mail Server versions earlier than 10.5.69, 10.6.x earlier than 10.6.40, and 10.7.x earlier than 10.7.2 are affected.

Risk and Exploitability

With a CVSS score of 8.7 the flaw is considered high severity. The attack can be carried out from any network host without authentication by targeting the public WebMail, WebAdmin, or WebMail Proxy endpoints. Although the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the lack of available patching guidance combined with the high impact suggests that the risk remains significant and a timely response is warranted.

Generated by OpenCVE AI on October 30, 2026 at 18:37 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Axigen Mail Server to v10.5.69, v10.6.40, v10.7.2, or later to remove the unbounded nesting flaw.
  • If an immediate upgrade is not feasible, block or restrict access to the WebMail, WebAdmin, and WebMail Proxy listeners from untrusted networks using firewall or access control lists.
  • Implement request size limits or rate limiting at the application or network layer to prevent excessively deep nested payloads from consuming server resources.

Generated by OpenCVE AI on October 30, 2026 at 18:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 30 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Description Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. Attackers can send a single deeply nested request to WebMail, WebAdmin, or WebMail Proxy listeners to exhaust the stack and crash SMTP, IMAP, POP3, and web services repeatedly.
Title Axigen Mail Server before 10.5.69, 10.6.40, and 10.7.2 Unauthenticated DoS via Nested Requests
First Time appeared Axigen
Axigen axigen Mail Server
Weaknesses CWE-674
CPEs cpe:2.3:a:axigen:axigen_mail_server:*:*:*:*:*:*:*:*
Vendors & Products Axigen
Axigen axigen Mail Server
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Axigen Axigen Mail Server
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-30T18:35:08.753Z

Reserved: 2026-10-30T15:35:12.805Z

Link: CVE-2026-119762

cve-icon Vulnrichment

Updated: 2026-10-30T18:27:27.317Z

cve-icon NVD

Status : Deferred

Published: 2026-10-30T18:17:26.957

Modified: 2026-10-30T19:23:25.493

Link: CVE-2026-119762

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T19:00:15Z

Weaknesses